Privacy after Puttaswamy: Constitutional Boundaries of State Data Collection under the Digital Personal Data Protection Act, 2023

Abstract

The recognition of privacy as a fundamental right by the Supreme Court of India in Justice K.S. Puttaswamy (Retd.) v. Union of India marked a decisive shift in Indian constitutional jurisprudence, particularly in the context of an increasingly data-driven State. In the aftermath of this landmark judgment, the enactment of the Digital Personal Data Protection Act, 2023 represents India’s first comprehensive statutory framework governing personal data processing. However, the Act raises significant constitutional questions, especially concerning the breadth of exemptions granted to the State for purposes such as sovereignty, public order, and national security. This paper examines whether the regime of State data collection under the Digital Personal Data Protection Act, 2023 conforms to the constitutional standards articulated in Puttaswamy, particularly the doctrines of proportionality, necessity, and procedural safeguards. The research problem centres on the apparent tension between the constitutional right to privacy and the statutory discretion accorded to the executive. Adopting a doctrinal and comparative methodology, the study analyses constitutional jurisprudence, statutory provisions, and comparative data protection frameworks, notably those in the European Union and other common law jurisdictions. The paper finds that while the Act strengthens data protection vis-à-vis private actors, it falls short in adequately constraining State power. It concludes that without clearer statutory limits and robust oversight mechanisms, the constitutional promise of privacy risks being diluted in practice.